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Status of this Memo 


This memo provides information for the Internet community. This memo 
does not specify an Internet standard of any kind. Distribution of 
this memo is unlimited. 


Abstract 


This document defines a set of criteria by which a DSA implementation 
may be judged. Particular issues covered include conformance to 
standards; performance; demonstrated interoperability. The intention 
is that the replies to the questions posed provide a fairly full 
description of a DSA. Some of the questions will yield answers which 
are purely descriptive; others, however, are intended to elicit 
answers which give some measure of the utility of the DSA. The marks 
awarded for a DSA in each particular area should give a good 
indication of the DSA’s capabilities, and its suitability for 
particular uses. 


Please send comments to the authors or to the discussion group 
<osi-ds@CS.UCL.AC.UK>. 
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1. Overview 


The purpose of this document is to define some metrics by which DSA 
products can be measured. Such metrics are valuable as whilst an 
X.500 DSA must conform to the specification in the standard - this is 
a sine qua non - protocol conformance is not in itself the hallmark 
of a usable implementation. A DSA must perform operations within a 
reasonable time; a DSA must offer good throughput of queries; a DSA 
must be able to handle a reasonable volume of data; if modification 
operations are provided, some sort of access control must be 
provided; a DSA and its data must be manageable. 


In many respects, it is almost impossible to say that one DSA is 
better than other from looking at the responses to questions in this 
document. For some, the cost or level of support will be the key 
criterion. For another user, the flexibility of the schema 
management facilities, or the feasibility of running the DSA over an 
existing relational database, will be of prime importance. In many 
respects DSAs will just be different, rather than better or worse. 
However, all other things being equal, the look-up speed of a DSA is 
very obviously measurable, and there is a substantial number of 
questions on the speed of the various X.500 operations, and in 
particular on the look-up operations. 


Throughout this document, some of the questions posed are annotated 
with a square-bracketed points score and an explanation as to how the 
points should be allocated. For example, a question might be 
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appended with "(2 if yes]", indicating score 2 points for an 
affirmative answer to that question. These points scores should be 
collated in Table 1 at the end of the document. The questions on DSA 
performance are judged to be important enough to have a separate 
table for those results: they appear in Table 2 (and optionally 
Table 3). Together, these tables constitute a measure of the DSA. 


The metrics are on a section by section basis, which should help the 
reader who is seeking, for example, a DSA with fast look-up 
capabilities and extensive access control facilities, to focus on the 
critical aspects of a DSA for their particular requirement. No 
conclusions should be inferred from adding the scores together into 
one overall grand total and comparing such totals for different DSAs, 
as no attempt is made to assign weights to the different 
characteristics. 


Whilst much of this document should usually be completed by the 
developers or suppliers of an implementation, the section on 
performance could be completed by anyone running the implementation. 
Indeed, it will be beneficial if several sets of performance figures 
can be gathered for each implementation, for a variety of hardware 
platforms. 


2. General Information 


This section contains general information about the implementation 
under discussion. 


1. Name of the information provider ........sssssseseseseseseseseseso 


2 Name of thë Implement attone sesser ce wie Wilke ere RO abies Geld eae nee 
3. Version number of the DSA described in this document ............ 


4. Are there plans to implement the additional features describe in 
the 1992/3 standard? [6 for full implementation, 4 if both 
access control and replication to be implemented, 2 for some 
LIJ <PEACULSS |) 2c Bees ees APow eae, E hard gen er E N a EE neta ese ek tlw dae A 
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6. Describe the hardware and software platforms supported by the DSA 
[up to 4 points may be awarded for this question] 


(a) Hardware (If appropriate, can summarise as, for example 
"generic UNIX platform") 


(b) O/S (state version if critical) 


i. UNIX) (be sure to indicate which flavour - e.g., 
SYSV fle BSD {lal SUNOS P eEG) te satis ode Soe act E oe ae E S 


ii. VMS) [1] 


iii. MS-DOS [1] 


iv. Macintosh [1] 


Wise OCS) P| eaire eine ae toe oe va ae a ata cenh E eee lo cece rigs eR pater a aces, 

7. Name any other software required to run the system which is not 
supplied with the operating system or with the DSA software 
itself. Examples might include a database package, or 
communications software 


8. Is this DSA an integrated part of a software package, and in such 
case which ? 


9. Is the software free? If the DSA needs other packages, are these 
also freely available? [3 if completely free, 1 if requires 
commercial software package] 


10. Is commercial support available for this implementation? [3] 
11. Is free, best effort support available from the developers? [2]. 
12. Is free support available via user groups or email lists? [2] 
3. Conformance to OSI Standards 
3.1 Directory protocols 
13. Does the DSA implement DAP? 


(a) Read ASE? [2] 
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(b) Se@at COAG Bree Zo) aaee inset eee ates r a tates odanioctere-su cleus Jedeutb EREE I Rra ESS 
(€E) -Modify ASE? (2i pond 5 oiae E E a E drei E Westies e E E eat So hs elven A 


14. Does the DSA implement DSP? 


A -Chained read ASE? FZ )0 <u. 4 iw ee i do el ee Sr i Aa 
(b). “Chatned search “ASH? (02) (oes. wwe Sek we ie A Sw SOA ieee 
(C) - “Chained: modify ASE? S20) a ct) seeks area ee Soe a Sa pane E See ee eee weal Sek 


15. Statement requirements according to section 9.2.1 in X.519. 


(a) Supported application-contexts? ce... cece ee ee eee eee eee eens 
(b) Capable of acting as first-level DSA? [1] ................... 
(©) Chained mode supported? [I] pian AeA Aled eed Bee Sed ta teed § 


(d) Security-level(s) supported? [1 for strong + 1 for protected 


simple + 1 for simple authentication] ....................... 
(e) All attribute types according to X.520? [1] ................ 
(£) -AIL object classes according. to X.521% © [VY ced on cert wees ee ee aes 


16. Does the implementation meet the conformance clauses in section 
9.2.2 and 9.2.3 of X.519? 
Static requirements [2 if yes on all] 


(a) Abstract syntaxes of application contexts .................--. 
(b) Abstract syntaxes of information framework .................. 
(E) -Minimal knowledge: serosa seee nee a e ase: 9 Mane oN E wee se eget Seen es 6 
(di). -Supporte OF root Context osae 5 ese ate: ee eee sees esata w Sete ee o's 
(e) Abstract syntax - attribute types .... ee ee ee ee ee ee ee eee 
(£). Abstract -syntax.—= ODJECE- CLlASSES~ derea moede ele eee wigies a wusreiene 


Dynamic requirements [2 if yes on all] 
(a) Mapping onto underlying services ..... . eee ee ee eee ee ee eee 


(b) Distributed operations = referrals wi cee ede eee e nese eases eee 
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Cey ~DITECrOryACCeSSAC: = fefërrals 0.5 sss: cise Sess ele ee wee ee eee 6 
(ad). ‘DaréctorySystemAC-— referrals ese eek se eee eee eee ele ere See eer a 
tek Charnedd: mode srra Eeer Seats ese ce, 3 E ee a E a pete tals Weaat evap dace, a RE 


17. Please list all conformance testing work applied to the 
implementation (specify conformance test version number). [2 -if 
any testing] 


3.2 Implementors’ agreements and profiles 


Does the DSA conform to the following implementors’ agreements? If 
so, state parts and version numbers. 


Does the DSA conform to the following profiles? If so, state which 
version numbers. 


203 UK FGOSIP? TAJ raria Eaa a E R tS a alg a E ara ea 


2bs WS: GOSIP? ELP ere kgen teann e e aa ea SMa acdc aid: aise big vege: Ge ends A ee 


State any other GOSIP profiles to which the DSA conforms ............ 
3.3 Protocol stacks 


22. Which of the following transport and network layer protocols does 
the DSA support: 


(a) TP.x over CONS (state transport class)? [2] ................ 
(b) VIP s4 “over (GLNS 2 02 Jussi sot e BA se tte de eet AS Ss a Wag a A 
(c) TP.x over X.25(1980) (state transport class)? [2] .......... 
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3.4 DIT structure 


23. A suggested DIT structure, detailing an object class hierarchy, is 
presented in X.521. Does the DSA: 


(a). Enforce this Aieranchy? © sada sheers Aine ahee are ee ar Sele ay Rie ede are eee 
(b) Allow the enforcement of this hierarchy? ................... 
24. Are structure rules optional or mandatory? ...........---2.2e0e0e 
4. Other protocols 


25. Not everybody uses OSI protocols at the network layer. Does the 
DSA support other "network" layer protocols? 


(a) TP.O0 over RFC1006 over TCP/IP [3] ... ccc ccc c ccc cece nace 


26. Does the DSA also run over any lightweight stack? If so, 
describe it with reference to the OSI seven layer model [1] ..... 


27. Can local DUAs access the DSA directly by some method of 
Iinter=process:.-communtGattons'e: JEL]. eee eens orcs Sea E serene se See bees 


5. Extensions to the 1988 Standard 
5.1 Schema 


28. Does the DSA fully support RFC1274, "The COSINE and Internet 
x 500M Sehema "el. o EZ cette a ete See ana oe Gt a deal eee and eet inte talc as 
If not, please supply a list of all those object classes, 
attribute types and attribute syntaxes in RFC1274 which are 
supported on a separate sheet. This might be summarised by 
saying, for example, "all those with standard attribute 
syntaxes", or "all except fooBar". 


29. Does the DSA implement the schema management defined in the 1992 
standard? [2] Scones ene a a alate a fete e a e velvet ents) eis thie Tere a Vane! sisetie ver elete, aus e 


30. If not, is the schema stored in the Directory? In a distributed 
manner |Z): ‘or ‘¢éntralised [as], 2 thawte J Bae A Eee ks Basa heey 


31. Can a DSA manager extend the schema and add new 
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(a) Attribute types with existing syntaxes? With compilation 
El: or- without: compa Latwon. [2J a sassa ea rE ah ere ole ener rebel le B78) one 

(b) Attribute syntaxes? With compilation [1], or without 
comprtatiron EDIE ie meer eo eneetiah peter ee een: cig Cavey aa ifs acreh tale on’ inal cane uate elcgic ise 

(c) Attribute sets? With compilation [1], or without compilation 
[eel tated ae ct chs Ase a dat ot kak ea LO ete a As 2a oe a Act al gett ied! 8 ot, hak 


(d) Object classes? With compilation [1], or without compilation 
pA Resa Pee eset aston aT EE aE Sra A at Sante, Tae EE O Masako E E ees E E S S S 


32. Is it possible to add in or modify DIT structure rules, with 
compilation [1], without compilation [2] 


5.2 Support for replication 


33. Does the DSA support the replication mechanisms as described in 
the 1992 standard [2]? 


34. Does the DSA support any other replication mechanisms? 


(a), Réplicaátion part- of RECIL276 T2] asser eee el ered ere ears E e e S 

(b) Other (please give a reference to any description of the 
mechanisms, and indicate whether these mechanisms are used by 
any other implementations) [1 for any mechanism] 


35. If the DSA supports replication, does it support: 


(a) Replication of a single entry? [2] 


(b) Replication of a set of sibling entries? [2] 


(c) Replication of a subtree? [2] 


5.3 Support for access control 


36. Does the DSA support access control as described in the 1992 
standard [3]? 


37. If not, does the DSA have any access control mechanisms at all? 
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38. If yes, does the access control scheme support the following: 
(a) Allow a user to maintain their own entry? [1] .............. 


(b) Allow a user to maintain some attributes in their own entry, 
but not all. attributes? . LL] seis eee bad AA Sikes Be eat 


(c) Give management rights to a DSA manager in a fashion analogous 
to the privileges given to a UNIX super-user? [1] .......... 


(d) Give management rights to a data manager on a per subtree 
TSS TS (N eta eae oak tae SE ere iss E OA EE andy tas se, EA toads E tuna 


(e) Give management rights (to an entry, group of entries, 
subtree, etc) to a group of users? [1] ....................-. 


(£f) Give access rights to users on the basis of the leading 
portion of their Distinguished Name? [1] ................... 


(g) Is it possible to define a protection mechanism for each 
individual attribute type in one entry? [1] ................ 


(h) Maximum number of Distinguished Names that can be defined for 
one access right to one attribute in one entry? If unlimited, 
state the constraints. [1 if more than 6 DNs are feasible] 


(i) Does the DSA support the extended access control techniques 
described in "An Access Control approach for Searching and 
Listing" by Hardcastle-Kille and Howes, in the Internet 
Draft, OSI-DS 21? [2] 


(3) If there are features of the access control mechanisms which 
are not brought out by the above questions, please describe 
these additional features [up to 2 for wonderful additional 
FEAEULS SIO © cic a a a ihe ine ee Se ee ee Rpt ee Soe Sed Shoes tee od dea 


5.4 Miscellaneous 


39. Does the DSA fully support RFC1276, "Replication and Distributed 
Operations extensions to provide an Internet Directory using 
X.500"? [2] .... If not, please give a list of features that are 
supported. 
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40. If the DSA uses RFC1006 and/or X.25(1980) at the network layer, 
does the DSA conform to RFC1277, "Encoding Network Addresses to 
support operation over non-OSI lower layers" [3] ............... 


6. Miscellaneous characteristics 


41. Does the DSA use its own database, or can it be used in 
conjunction with a general-purpose database package such as 
Oracle? [1 for own, 1 for ability to map onto general purpose 
databases, 1 if any such mappings have been made] ............... 


42. If the DSA runs as a static server, state the start-up time for a 
DSA with a database of 20000 entries. If this varies widely 
according to configuration options, give figures for the various 
OPETONS <>, dite a e he OA cite a 3 Saitoh a Rise Ete eS AS cto Oe ie Mid Sa tt ats 


43. What is the maximum number of simultaneous associations that the 
DSA may have open? [1 if more than 15 associations] ............ 


44. Maximum database size, in entries, megabytes, or as appropriate. 
If none, state what the constraints are. [1 if a database of 
more than 100,000 entries is feasible] ... ee. eee eee ee eee 

45. What is the run-time size of an entry as specified in section 10 
(on performance)? This should be the marginal size of an entry 


and thus should include the overhead of default indexes, etc. 


46. What is the on-disk database size of an entry as specified in 
section 10 on. performance? acdsee Sed SE4 Malas Bite derind es C4 Sis eats & 


47. Does the DSA make of indexing? [2 if yes] .....................- 
If so: 


(a) Can the database be fully inverted? [1] .................... 
If not, state for which: 
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(b) Does the index improve performance on: 


is Exact måte PAD SF cea ee tee. ol a a a a a o a a fetes sia sits 
iii- Leading substring match. CIJ t-tests. te pad Sane be 
hides . Approximate «mabch= (LE), cist ath Se ae tee Sake Be Dae 
IVs- Any substring Maten |Pl yf xu dec-cicy seeee io Seet Ocoee sre deed s.042 Star ds sak 
Ver ‘Trait ling substring matce [Lit sies eea yee aie gS E E Sento sce 


(c) What is the increase in run-time size of an entry when adding 
an index? 


(d) What is the increase in on-disk database size of adding 
another index? 


48. What sort of approximate match algorithm does the DSA use? 
DESCELDE* PE DETER LY al skid ester dee tee a eck hee Rea Se. BMG ela eles Sew ec arene Wn Beene 


49. Does the DSA attempt to use relay DSAs (which have access to more 
than one network) in order to achieve connectivity with DSAs 
which are not on the same network? [2] ...........-------eeeeeee 

7. Management tools 


7.1 Dynamic system management 


50. Are there tools for monitoring DSA activity, using: 


(a) ODAR? sd tng os 2 e en aaa E Moats rons Bae AE A Sony he tak one a A Go e-B had 
(O) "EMER. PET aha ete te RM eee Sed 8k IS Ake ds ois Be Rh 
CEJ SNMP? PET| asee ocr a ie ti Sse. a ENT bia env E we ud cleo E ie ye Situs ewer Sloe ARIE RENTS 
51. Are there tools for controlling a run-time DSA? [2] ............. 
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7.2 Static system management 


52. If knowledge information is stored within the DIT, are there 
tools for knowledge management? [2] ........ 2. cee ee ee eee ee ee eee 


53. Are there tools for checking that attributes with Distinguished 
Name syntax contain values of entries in the DIT (i.e., they do 
not contain "dangling pointers")? El] sies cede keg ee 


7.3 Data management 


54. If the DSA doesn’t use a general-purpose database package, what 
data management tools are available? ...... eee ee ee ee ee ee ee eee 


55. Are there any tools for arboriculture - the moving, copying or 


deleting of: DIT: subtrees?) 2I saiiceew. ohne eS oae a ai there 2.8 Gabe eee ars eee 
8. Operational Use 
The DSA may have lots of wonderful features -- on paper! But has the 


DSA been shown to work in practice? The following measures are 
intended to give some measure of confidence that the DSA’s viability 
has been demonstrated. 


56. How many entries in the largest DSA in use in operational use? 

57. What is the largest set of DSAs supporting an organisation? 

58. What is the estimated number of organisations using this 
implementation for service use? [8 if more than 100 
organisations, 5 if more than 50 organisations, 3 if more than 20 
organisations, 2 if more than 5 organisations, 1 if more than 1 


OFGansSaceOrm |. ie a ek Rae Boks i idee ieee a MAS tet tat es tt Mier a A a Be teeth a 


59. Is this DSA used commercially with an installed base of more than 
LO mCUSCOMETS es apal de cwtii est esos Gate edt ed wy eis CAL BG etal RAT ans a Shana He) oes 


9. Interoperability 
The X.500 Directory is the OSI Directory. OSI stands for Open 
Systems Interconnection -- DSAs have to be able to inter-operate. 
They also have to be seen to interoperate. 


605- Ts “this: DSA in use- in=-X.500- PLlGt si? alts ei a wks BAe tee BA a ela bs Y 


(a) Is this DSA in use anywhere in the COSINE/Internet Pilot? [3] 
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(b) Is this DSA in use in any other major pilot? [ds 28 te cee ete 

61. Name any other systems which you believe the system to 
interoperate with. (It is not sufficient to say "any system 
which supports the conformance clauses ...") 


62. Please name all interoperability testing applied to the 
implementation, specify test suite and what other implementation 
that was used [1 per implementation, up to maximum of 5] ........ 


10. Performance 


This section should give an outline to the expected performance of 
the DSA. A number of operations are timed in order to give a feel for 
the DSA’s speed and throughput. Note that all operations should be 
resolvable within a single DSA. Chaining and referral are not 
assessed, although it should be possible to infer, albeit 
approximately, the speed of distributed operations. 


i. The tests should be made against an organisational database of 
20000 entries. Some tests are against subsets of this data, and 
so the database should be set up according to the following 
instructions. 


Create an organisational DSA with 20000 entries below the 
organisation node. Sub-divide this data into a number of 
organisational units, one of which should contain 1000 entries, 
another of which should contain 100 entries, and a third which 
should contain just 10 entries. The entries, which should 
differ, should be created with the following attributes: 

(a) Common Name 

(b) Surname 


(c) Telephone number 


(d) Postal Address (of 100 characters) 
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(e) Object class 


ii. In all the tests, two timings should be taken. In order to 
normalise the test results as much as possible, it is suggested 
that these tests be undertaken on an otherwise lightly loaded 
machine. 


(a) A typical "cold start" reading should be given. In this 
case the system will not have the advantage of any benefits 
that derive from operating system paging, or caching. 


(b) A best possible figure should be given, which indicates the 
upper limit of DSA performance. 


iii. The timings should relate to the default set-up, and should be 
entered in Table 2. If significant performance gains can be made 
by use of configuration options, such as building extra indexes 
to support searches, measures of the improved performance may 
also be given, and should be entered in Table 3. 

Attention should be also drawn to any optimisations, heuristic or 
otherwise, which are not evidenced in the following tests. 


iv. Please note that the tests should be made using a DUA and DSA 
with full 7-layer stacks, rather than some lightweight protocol. 


10.1 Speed for various operations 


The tests are described, one subsection per operation. The results 
should be entered in Table 2 (and Table 3 if a non-default set-up is 
also measured). 

10.1.1 Bind 


The time it takes for a DUA to bind to the Directory. This time 
should include all the initialisation time a DUA process needs before 
it can query the Directory: e.g., reading of tailor files, schema 
information, etc. Give the bind time for each of the following 
levels of authentication. State "n/a" if the implementation does not 
support a particular level of authentication. 

63. Anonymous 

64. Simple 

65. Simple protected 


66. Strong 
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10.1.2 List 


Give the time for listing a set of organisational unit sibling 
entries. 


67. 10 entries 
68. 1000 entries 
10.1.3 Search 


In this section, two sets of search operations should be performed on 
the DSA. 


i. A single level search of 100 entries within an organisational 
unit. 


ii. An organisation subtree search, on the subtree of 20000 entries. 


The following searches should be tried. Unless otherwise stated, the 
"XXX" or "YYY" part of the search filter should be chosen in such a 
way as to return a single result. Unless stated otherwise the 
results should return all attributes for the entry. 


69. Exact match for a surname: 
surname=XXX 

70. Leading substring match for a common name: 
commonName=XXX* 

71. Any substring match for a common name: 
commonName=* XXX* 

72. Trailing substring match for a common name: 
commonName=* XXX 

73. Approximate match for a common name: 
commonName"=XXX 


74. More complex filter, searching by object class and two other 
attribute types: 
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10. 


10. 


10. 


10. 


objectClass=person AND 
(commonName=XXX* OR telephoneNumber=*YYY) 


January 1994 


75. Search returning all entries (i.e., 100 entries in the single 
level search, and all 20000 entries in the subtree search: 


objectClass=* 


In this case, no attribute values should be returned in the 


result set. 


1.4 Read 


76. A single read operation, returning all attributes. 


1.5 Add entry 

77. Add an entry beneath an entry which has: 
(a) 0 children 
(b) 10 children 
(c) 1000 children 

1.6 Modify entry 


Modify an attribute value, other than an RDN value, 
which has 


1. 10 siblings 

2. 1000 siblings 

78. Modify an entry 
(a) Add description attribute 
(b) Remove description attribute 


1.7 Modify RDN 


for an entry 


Modify an RDN value for an entry with the following number of 


siblings. 
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10. 


10 


10. 


79. Modify RDN 
(a) 10 siblings 
(b) 1000 siblings 
1.8 Query rate 
As the time taken for a single read will usually be negligible, the 
following list and set of reads should give a clearer indication of 


the query rate. 


80. A list to return 100 entries for persons, and then a read of each 
entry returning all attribute values. 


-2 The results 


The results of the tests just described should be entered in Table 2 
(and optionally Table 3), at the end of the document. 


3 Environment used for benchmarking 


Date: OF USSG, sis eor sisi Jee Serva Gee chi lave Sa occa sole: e A Guetta te Sout Ge EE se Soule: Balai Giei hie Teo ENS 
NaMEVOE tester aeiae iai ore teh Seo Slt Bake Longe NeMS a AN See BONS eed S ones a aE on arae 
The results will be directly correlated to the test set-up used, and 
in particular, the hardware. Please answer the following questions 
to describe the test environment: 


(a) --Pwocessor “(make sands mOde Dy) oi cee se. 5 re Mere Serie pee e eee Se ew ee 
(D) “PROCeSSOr-SHPeed. (MIPS) heise eile Siete A Soe e ae aire Aa Siento. oi saa Pray enews. e a 
(Cc). Primary: memory avai Lable: ses ieee dN ack eS ee ee eh wee 
(d) If disk-based DSA, disk I/O interface and disk speed ........ 
EF OZS Version ereen os eee Eee eye Us ie he SiS E Se Sie eS SS 
(£) Network type and bandwidth (e.g., 10 Mbit Ethernet) ......... 


(g) Protocols in transport layer and below (e.g., TP 0, RFC1006, 
TERS ERY Once ser Sala ce er a ca crease wade ten epee wero Se a tee dled oes 


(h) How/where timings obtained? 
©- °C. procedural: interface 6.ns dis hai piers Deis ype eek aS ore wee 


© DUVA ‘shel. (e.g. Qüipu s DISH) segased ew Sees asne See ee ok 
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+ ——— — — — — 
| Section | | Points 
+-------------------------------- | --------------- 
| No.| |Description Maximum| Scored 
ed |------+------------------- |-------|-------- 
| | | | 
| 2| |General Information | 20 | 
t=- | |-------------------------- |------- |-------- 
3l Conformance to OSI | 35 | 
tres, | nace Aiea AG) Cie MARTE aa sprees 
| | 
4||Other protocols | 5 | 
t=- | |--+--4------------------ |------- |-------- 
| | | | 
5| Extensions| Schema | 16 | 
+---- ee 
| 
| ||to the |Replication 10 
t=- | eae =22-2------ m |-------- 
| | | 
| liaa Access Control | 15 | 
+---—- ee ee 
| | | 
|| standarda |Miscellaneous | 5 | 
t=- | |-------------------------- | ------- |-------- 
| |Miscellaneous | | 
6| | characteristics | 15 | 
+---—- ee ed 
ars 
| 7||Management tools MATOS a 
t=- | |--+-2-------------------- |------- |-------- 
| | 
| M use 10 
+---—- SS ee 
| 
9| | Interoperability 10 
t=- | ene |------- |-------- 
| | | see | 
10 | | Performance |table 2| 
+ ——— — — — 
Table 1: DSA Metrics 
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| Cold DSA | | Optimum | 


| 
ee ee |e 
| Bind | | 
| --Anonymous | | 
| --Simple E E Era rt al ea ae | 
| --Simple Prot || 
| —-Strong | 
+ 

| 

| 


List 


level | level | 


+ 

| 

| -- exact | 

| -- leading sub | 

| -- any sub | Seana 
| -- trailing sub |.... |e eet Spee tl Aasa 
| -- approx | 

-- complex 

| -- return all | 

+ | 

| 

+ 


0 siblings 
| 10 siblings 
| 1000 siblings 


| Modify 
10 siblings 
1000 siblings 


| Modify RDN 
10 siblings 
1000 siblings 


Table 2: Speed of operations - default set-up 
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| Cold DSA | | Optimum | 


| 
ee ee |e 
| Bind | | 
| --Anonymous | | 
| --Simple E E Era rt al ea ae | 
| --Simple Prot || 
| —-Strong | 
+ 

| 

| 


List 


level | level | 


+ 

| 

| -- exact | 

| -- leading sub | 

| -- any sub | Seana 
| -- trailing sub |.... |e eet Spee tl Aasa 
| -- approx | 

-- complex 

| -- return all | 

+ | 

| 

+ 


0 siblings 
| 10 siblings 
| 1000 siblings 


| Modify 
10 siblings 
1000 siblings 


| Modify RDN 
10 siblings 
1000 siblings 


Table 3: Speed of operations - non-default set-up 
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Security Considerations 
Security issues are not discussed in this memo. 
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